Cybersecurity Asset Management for Healthcare in Nashville: Close the Inherited Gaps
On the morning of 23 November 2023, Nashville-based Ardent Health Services began responding to an incident on its network. Ardent said it proactively took its network offline, which suspended user access to corporate servers, Epic software, internet and clinical programs. Some of its 37 facilities diverted emergency room patients and rescheduled non-emergency procedures.
When a security team has to isolate a network, the first questions are what sits on it and what depends on it. Cybersecurity asset management for healthcare in Nashville (CSAM) answers both questions across every facility, entity and inherited system a management company operates.
Nashville concentrates this challenge in one city. The Nashville Health Care Council’s 2025 economic impact report counts 17 publicly traded healthcare companies headquartered in the city and $72.1 billion in regional healthcare economic output for 2024. Operators that grow by adding facilities and entities inherit networks, tools and registers someone else built.
What healthcare guidance asks security teams to know
Federal healthcare guidance treats an accurate healthcare asset inventory as a base for risk analysis and incident response. The sources below carry different weight, so the table states the status of each one.
| Source | What it says | Status |
|---|---|---|
| HHS 405(d) IT Asset Management pulse check | Lists inventories for computers and servers, mobile devices, network equipment, connected devices and software. Each inventory is audited frequently, and decommissioned devices are removed through a documented procedure. | Guidance |
| HHS healthcare cybersecurity performance goals | Names Asset Inventory as an enhanced goal: identify known, unknown (shadow) and unmanaged assets to detect and respond to new vulnerabilities faster. | Voluntary |
| HIPAA Security Rule NPRM, 27 December 2024 | Proposes changes to the Security Rule to strengthen cybersecurity protections for electronic protected health information. | Proposed rule, and HHS states the current Security Rule remains in effect during rulemaking. |
| OCR Summer 2020 Cybersecurity Newsletter | Reports that OCR investigations frequently find organizations lack a clear picture of where their ePHI is located. States that the Security Rule leaves an IT asset inventory optional, and that an up-to-date inventory can support risk analysis. | Guidance |
The OCR newsletter also describes an unpatched connected device, such as an HVAC access system, as a possible foothold into a hospital network. For network equipment, the 405(d) sheet lists fields such as asset tag, manufacturer, model, location, serial number, in-service date, IP address, OS version, and MAC address. Teams that want to connect these sources to HIPAA obligations can start with this overview of HIPAA compliance through a CMDB.
Why a management company’s estate is hard to see
Flexera’s 2026 State of ITAM report, a cross-industry survey of 512 professionals, found complete IT visibility fell to 36% from 43% a year earlier. The same report shows 78% of ITAM teams say maintaining an accurate inventory is their top priority. That decline is a healthcare cybersecurity asset visibility problem as much as a general ITAM one; it widens fastest in organizations that grow through acquisition. Three patterns create that gap in multi-site healthcare estates.
- Acquired facilities arrive with their own tools and registers. Virima’s healthcare case study describes a health system formed through mergers. Its new IT operations team was unfamiliar with the inherited systems. Individual hospitals kept asset data in spreadsheets and tools that stayed out of reach for the wider IT organization, so security ends up triaging across inventories that disagree.
- Connected clinical and building devices sit outside the IT list. The 405(d) pulse check lists connected devices as an inventory category, and the OCR newsletter describes unpatched building devices as an entry point. Result: devices share networks with ePHI systems while their owner and patch status remain unrecorded.
- Retired systems leave stale records behind when nobody records the decommission step. A system retired without recording can stay powered on and unpatched, and its register entry remains. A named owner who decides each retirement closes that gap. Result: stale records, unpatched leftovers, and maintenance paid for systems that have since been retired.
The healthcare IT asset management guide covers how to structure a program that spans several sites.
What an unclear estate puts at stake
IBM’s Cost of a Data Breach Report 2026, as summarized by Becker’s Hospital Review, puts the healthcare average at $6.64 million per breach. That figure is down 10.5% from $7.42 million in 2025, and healthcare remained the costliest industry for the 13th consecutive year. That cost figure is healthcare-specific. Across all industries generally, the mean time to identify and contain a breach rose to 247 days.
Scoping an incident takes longer when the team must first establish which systems exist and what they connect to. A current record of systems and dependencies shortens that first step.
Cybersecurity asset management for healthcare in Nashville: one record across every site
Cybersecurity asset management gives a security team one record of what exists, who owns it, and what it connects to. CSAM, ITAM, and a CMDB all draw on the same discovery data but serve different jobs: ITAM tracks lifecycle, licenses, and cost; a CMDB tracks configuration items and relationships for ITSM work; CSAM uses both to rank risk, ownership gaps, and incident blast radius. Virima’s cybersecurity asset management capability builds that record through three mechanisms.
- Discovery builds one inventory across every site. Agentless probes, more than 140 and extendable, scan servers, network devices, storage and hypervisors on-premises. A lightweight agent on Windows, macOS, and Linux covers roaming endpoints, and API connectors cover AWS and Azure. IT discovery finds managed and unmanaged devices within network reach, including virtual machines, cloud resources, rogue access points, guest machines and IoT devices. Credentials stay encrypted on the Discovery App server inside your environment. Discovery runs on a high-frequency schedule that your team sets. Network reach and protocol compatibility set the limits, and devices that resist automated methods need manual registration.
- Every discovered CI carries ownership and criticality, not just a timestamp. A source tag and a last-verified timestamp sit on each record by default. Your team supplies owners and criticality on top of that, and the customizable Service Value Rating turns that input into a score for each service, application, and asset. Security uses the score to order remediation, patching, change, and incident work.
- ViVID™ maps the dependencies between systems. Service mapping shows relationships and communication flows between systems, with open incidents and changes overlaid from connected ITSM tools. Your team defines each service once, in the interface or by CSV import, because service definitions rely on institutional knowledge. Known vulnerabilities come from the NIST NVD integration, which also flags unpatched devices and unauthorized software versions. Patch checks cover Windows systems only.
| Area | Per-site registers and separate tools | One discovery-fed record |
|---|---|---|
| How the list is built | Manual entry in spreadsheets and local tools | Scheduled discovery feeds a single record |
| Acquired facilities | A separate register stays until someone merges it | Discovery runs on the new network ranges and cloud accounts, and results join the same record |
| Unmanaged devices | Found when someone checks | Found within network reach on each scheduled cycle |
| Ownership and criticality | Held in people’s memory or per-site columns | Stored on each record with a criticality score |
| Dependency view | Drawn by hand during an incident | Shown as relationships and communication flows |
| Effort to reconcile | Recurring comparison across registers | Source conflicts resolved by rule, with a source tag on each attribute |
| What still needs people | Every step | Service definitions, ownership, criticality and manual registration of unreachable devices |
What the asset record answers and what security tooling owns
An asset record gives security teams and their tools shared context. It sits beside detection, access and response controls.
| The asset record answers | Other tools and teams own |
|---|---|
| What exists and where it sits | Threat detection and response (SIEM and EDR) |
| Who owns each system | Which systems hold ePHI (privacy and data owners) |
| What each system connects to | Patch execution |
| When each record was last verified | Access control |
| Which known vulnerabilities apply | The decision to isolate a network |
Before an isolation decision, the dependency view shows which defined services sit on the affected segment. The same discovery data feeds the CMDB that ITSM teams use for change and incident work.
Where the efficiency and savings come from
Each cost line below can be measured at your own company before and after a rollout. The evidence column shows what exists today, and every vendor-published item is labeled.
| Cost line | Where it shows up | How to measure it | Evidence |
|---|---|---|---|
| Incident scoping and triage | Hours spent listing affected systems and what depends on them | Time to build that list for a past incident, before and after adopting a dependency map | The healthcare case study (vendor-published, customer anonymous) describes an outage where the application vendor named four servers and Virima showed 12 more. |
| Duplicate registers | Quarterly reconciliation across sites and tools | Registers maintained and hours spent reconciling them | Mechanism described above |
| Bringing an acquired facility into the record | Days from close to a usable inventory | Days per acquisition, before and after | The case study (vendor-reported) says scans were running within several hours of the pilot start. |
| Software audits and unused licenses | Vendor audits and renewals | Audits in three years, spend, and installed versus entitled | Flexera 2026 (cross-industry): 48% audited in the past year, 44% spent over $1M on audits in three years, and license reuse produced significant savings for 43%. |
| Maintenance on retired assets | Support contracts | Contracts compared with live assets in the record | Mechanism described above |
| Staff onboarding | Time for new security and IT staff to learn the estate | Weeks to first independent triage | The case study (vendor-published) says onboarding is easier because critical information is accessible and kept current. |
Software audit and license lines connect to IT asset management once discovery supplies installed-software data.
The first 90 days across multiple sites
- Name an owner for the asset record and an owner for each domain: security, IT operations, clinical engineering, and facilities.
- Pick one facility and run discovery across its network ranges, cloud accounts, and endpoints. Set a scan cadence the team can keep.
- Reconcile discovery results against existing registers and clinical engineering lists. Investigate unknown devices and audit the record frequently, as the 405(d) sheet advises. The Stay Audit-Ready use case and this guide on how discovery-sourced records speed up IT asset management audits show how this evidence supports audits.
- Define the critical clinical and business services in ViVID™ with the people who know them, and set criticality ratings with clinical leaders.
- Repeat these steps for each new facility, name an owner for each decommission, and connect the record to your ITSM tool through the supported ITSM integrations.
Start with one facility
Run a discovery pass on one facility and compare the results with your security team’s current list. The differences mark the inherited gaps. Trusted Runtime Truth shows what exists, how it connects, and who owns it.
Frequently Asked Questions
What is cybersecurity asset management for healthcare?
It is the practice of keeping a current record of devices, software, and services, with an owner and criticality for each. Security teams use the record to decide what to patch, isolate, or investigate first.
How does CSAM differ from ITAM and a CMDB?
All three draw on the same discovery data. ITAM tracks lifecycle, licenses, and cost; a CMDB tracks configuration items and relationships for ITSM work; and cybersecurity asset management (CSAM) uses both to rank risk and ownership gaps.
Why do Nashville healthcare management companies need one record across sites?
Acquired facilities arrive with their own tools and registers, so each security team inherits several lists that disagree. One discovery-fed record gives every site the same fields, owners, and criticality ratings, which makes triage consistent.
How does Virima handle connected medical devices?
Virima’s medical device asset management discovers devices that sit within network reach and speak a compatible protocol. Devices that resist automated methods get manual registration. Coverage varies by device class, so a discovery pass on one facility shows what is reachable.
Does Virima work with ServiceNow or Jira Service Management?
Yes, Virima integrates with ServiceNow, Jira Service Management, Ivanti, Hornbill, HaloITSM, Xurrent and TeamDynamix. Open incidents and changes from those tools appear as overlays on ViVID™ service maps.
